8f319a94ca172c493096b1f5089dfe0344dca3835dbb79e197d372e81a77931d | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 03:09

Sharing

Report Analysis Logs

General

Target

CsvOperation.dll
Size

32KB
MD5

b014045b2120187a034e73f31f4516a0
SHA1

44cd0d4c6ce6a52c02a769069197be79ee8401ba
SHA256

94e1726e3737fe369d829e782c0c651c200b80245df4815971c1a1d4d6b95a13
SHA512

31c5a78479bd42aa86e720333bf73fa4add1ef88c7ce2eb932763af5aaafd9ee002786c63f0079cad3a9a5107025b1cd603a24b483ed3eb8e41a6a776c062a53
SSDEEP

384:EJVlxYvIbnRVWPLXfCyBjCkTVefCyBjCkhV8JN77hh/x:oBYgRVO62ukTVe62ukhy3h5x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	5048	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5048	3028	rundll32.exe	84
PID 3028 wrote to memory of 5048	3028	rundll32.exe	84
PID 3028 wrote to memory of 5048	3028	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CsvOperation.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CsvOperation.dll,#1
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 600
    3⤵
    - Program crash
    PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5048 -ip 5048
1⤵
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads